PeopleSoft PeopleTools CVE-2026-60887

Exploitation requires the attacker to already hold HIGH privileges and valid logon access to the infrastructure/host where PeopleSoft Enterprise PeopleTools executes (AV:L, PR:H) - this is not remotely reachable. The flaw is specific to the Data Mover component on PeopleTools versions 8.61-8.63. Critically, a successful attack also requires human interaction from a person OTHER than the attacker (UI:R), meaning a separate privileged user must perform an action (e.g., executing a Data Mover script/operation). Oracle explicitly rates it 'difficult to exploit' (AC:H). These combined limiting factors - local access, pre-existing high privileges, a second human victim, and high complexity - sharply constrain realistic exploitation to insider or post-compromise scenarios rather than opportunistic attacks.

This is a genuinely low-priority vulnerability despite affecting a significant enterprise product. Every CVSS signal points to high exploitation friction: the vector CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L requires local access to the host where PeopleTools runs (AV:L), high attack complexity (AC:H), already-high privileges (PR:H), AND user interaction from a separate victim (UI:R), yielding a base score of only 3.8 (LOW). Oracle itself describes it as 'difficult to exploit.' No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis - so there is no evidence of real-world exploitation. The combined requirement of pre-existing high privileges plus tricking another user makes this a chained, insider-adjacent scenario rather than an internet-facing threat. There are no conflicting signals here: the description, the CVSS vector, and the absence of exploitation intelligence all agree this is a low-risk issue that should be patched during routine Oracle CPU cycles, not as an emergency. The 'Denial Of Service' tag is accurate but refers only to a partial DOS (A:L), not a full outage.

A high-privileged PeopleSoft operator with local logon to the PeopleTools host crafts a malicious Data Mover script or input and induces a second privileged user to execute it. When that victim runs the Data Mover operation, the attacker gains limited unauthorized read, limited modification (insert/update/delete) of a subset of PeopleTools data, and can cause a partial denial of service. No public exploit is identified at time of analysis, and the chain depends on both local access and social engineering of another user.